2023 is the year attackers stopped going after companies and started going after the things companies depend on. Identity providers, managed file transfer software, CI platforms, vendor support systems - infrastructure whose entire purpose is to be trusted by everyone behind it, and which therefore converts one compromise into hundreds.
Eight kill chains on this site carry a 2023 date. Cl0p turned mass exploitation of a single unauthenticated flaw into a repeatable business model, Okta was compromised twice by different routes, and Mandiant documented the first case of one software supply chain attack being used to execute another.
On this page
Overview: the shape of 2023
The year's defining realization is arithmetic. Breaching a thousand organizations individually is a thousand campaigns. Breaching the one product all thousand use to move files is one campaign - and the effort per victim falls to nearly zero once the flaw is found.
Cl0p proved it twice, having already proved it with Accellion in 2021 and GoAnywhere earlier in 2023. The MOVEit campaign exploited an unauthenticated SQL injection zero-day, deployed a web shell, and harvested roughly 2,600 organizations and 77 million people in a campaign Mandiant measured in days rather than months. Most of the eventual victims had never heard of MOVEit; their payroll processor or benefits administrator ran it.
Meanwhile the identity layer took sustained fire. Okta was compromised twice by unrelated routes - a subcontractor's support engineer in January 2022 whose disclosure landed in March, and its own customer support system in October 2023. Storm-0558 forged authentication tokens for government mailboxes using a stolen Microsoft signing key. And Scattered Spider showed that the fastest route past an identity provider is often a phone call to the help desk.
The incidents that defined 2023
| Incident | When | Root cause in one line |
|---|---|---|
| CircleCI | Dec 2022-Jan | Malware stole a live 2FA-backed SSO session cookie from an engineer's laptop |
| LastPass | Aug 2022-Jan | A keylogger on a DevOps engineer's home PC reached encrypted vault backups in S3 |
| 3CX / X_TRADER | Mar | A trojanized trading app on a personal PC led to both 3CX build environments |
| MOVEit / Cl0p | May-Jun | Unauthenticated SQL injection zero-day in managed file transfer software |
| Storm-0558 | to Jun | A stolen MSA signing key found in a crash dump forged tokens for government email |
| Microsoft SAS leak | to Jun | An over-permissioned SAS token in a public repo exposed 38TB for about three years |
| Scattered Spider / MGM | Sep | LinkedIn OSINT fed a vishing call to the help desk, yielding Okta super-admin |
| Okta support system | Sep-Oct | A service account synced to a personal Google profile; HAR files held session tokens |
Theme 1: Mass exploitation became a business model
Cl0p's target selection is strategy, not coincidence. Managed file transfer products must be reachable from the internet so partners can upload to them; they are bought by organizations handling regulated data, because that is the point of buying one; and they hold that data concentrated in a single database, usually for far longer than intended because retention was never configured.
One unauthenticated flaw in such a product therefore yields regulated data from hundreds of organizations with no per-victim effort. MOVEit was the third iteration of that model, and the tempo is the operational lesson: with roughly 2,674 MOVEit servers exposed at the time and exploitation fully automated, the harvest was largely complete before most organizations had finished reading the advisory.
The disclosure tail ran well over a year as downstream victims were identified, and the question most organizations could not answer was which of their suppliers held their data and on what software. That question was still unanswerable for most of them when Oracle EBS repeated the playbook in 2025.
Theme 2: The identity provider became the target
An identity provider is a single point of trust for every application behind it, which makes its own supply chain everyone else's problem. 2023 made that concrete repeatedly.
The Okta support system compromise is the clearest example, and its root cause is uncomfortably ordinary: an employee signed into a personal Google profile in Chrome on a managed laptop, and the browser synced a service account credential into that personal account. The support system it unlocked held HAR files - full browser network traces uploaded by customers for troubleshooting, containing live session tokens. Three customers detected it before Okta did, while Okta's own investigation was blinded for fourteen days by a logging gap where the same file generated different event types depending on how it was reached.
Storm-0558 attacked the layer beneath: a Microsoft signing key recovered from a crash dump, used to forge authentication tokens for government mailboxes. And Scattered Spider demonstrated that none of that sophistication is necessary when a help desk will reset multi-factor authentication for a caller who sounds convincing.
Theme 3: Supply chains got more than one link long
Mandiant identified the 3CX intrusion as the first publicly documented cascading software supply chain compromise. A 3CX employee downloaded a trojanized, end-of-life version of X_TRADER - unrelated to their work, on a personal computer - which gave UNC4736 their corporate credentials. Those credentials reached the network over VPN, then both the Windows and macOS build environments, so 3CX signed and shipped a backdoored softphone to its own customers.
Read end to end: Trading Technologies was compromised, which compromised a 3CX employee, which compromised 3CX, which compromised 3CX's customers. Vendor risk management as normally practised cannot see that, because assessing your direct suppliers tells you nothing about theirs, and questionnaires do not propagate.
It also established a point that recurs through every later year: code signing establishes authorship, not that the authoring environment was trustworthy. The malicious 3CX build was correctly signed, and so was the trojanized X_TRADER installer before it.
Theme 4: Sessions, not passwords
Two chains this year turned on stealing proof of authentication rather than credentials. At CircleCI, malware that the deployed antivirus did not detect stole a live, 2FA-backed SSO session cookie from an engineer's laptop, letting the actor impersonate them remotely and reach production systems holding every customer's environment variables and tokens. The advisory that followed - rotate every secret you have stored with us - found most organizations unable to answer what those secrets were.
The Okta HAR files were the same property arriving by a different route: tokens that customers had voluntarily uploaded, replayed to hijack live sessions at five organizations.
The point generalizes uncomfortably. A session token is the system's own record that authentication already succeeded, including the second factor. Steal it and you inherit that proof without repeating any of it - no password prompt, no MFA challenge, and no failed login for anyone to alert on. "We enforce MFA" and "our sessions cannot be stolen" are unrelated claims, and 2023 is when the industry started having to say so.
What this meant for 2024
Mass exploitation kept working, so it kept happening. Cl0p's model was sound enough to run again with Oracle EBS in 2025, and the class of target - internet-facing enterprise software holding aggregated regulated data - has not become meaningfully smaller.
The identity layer got harder to attack directly, so attackers went around it. Session theft, token replay and consent abuse all sidestep the authentication controls organizations spent 2023 strengthening. That trajectory led straight into 2025's SaaS-to-SaaS trust chains, where there is no authentication event to attack at all.
Endpoint compromise kept being the first domino. LastPass through a home computer, 3CX through a personal PC, CircleCI through an engineer's laptop. In each case a machine outside the organization's control held or reached something inside it - the same shape that opened Snowflake in 2024 and Vercel in 2026.